Although GDPR has been in place for some time, my organisation has had a dispensation to essentially ignore it up until now. The dispensation was because the contract from the government we were on was an interim basis while a new provider got their system online. The thinking was we'd be turning off our system at any time and handing over. Fast-forward seven years and the new provider hasn't done what was asked of them, so we're staying put.
We've now been told by the ministry to bring ourselves into GDPR compliance and one of the issues being raised is about backups. My understanding is that for day-to-day business, simply deleting the backup file when it ages out is enough to be compliant. More thorough cleansing is possibly needed when disposing of hardware, but no extra measures are required for business-as-usual backup maintenance.
However, there's some questions being asked about whether we need to completely erase any deleted files from the disk. This complete erasure apparently uses third-party software to totally remove the file and render it unrecoverable.
Is it now the norm to completely erase backups due to GDPR?
If that's what people have always done and we've never been doing it right, I'll take that too.